Windows devices with no BitLocker recovery key in Entra ID

#Requires -Modules Microsoft.Graph.Authentication, Microsoft.Graph.Identity.DirectoryManagement, Microsoft.Graph.Identity.SignIns
# Windows devices in Microsoft Entra ID with no BitLocker recovery key stored in Entra ID.
# Read-only. Lists key metadata only; the recovery key itself is never requested.

Connect-MgGraph -Scopes 'Device.Read.All', 'BitlockerKey.ReadBasic.All' -NoWelcome

# A recovery key's deviceId is the device's deviceId property (the ID set at
# registration), not the device object's id. Match on deviceId.
$devicesWithKeys = @{}
# No -Property: without $select the key itself is not returned.
Get-MgInformationProtectionBitlockerRecoveryKey -All |
    ForEach-Object { $devicesWithKeys[$_.DeviceId] = $true }

Get-MgDevice -All -Filter "operatingSystem eq 'Windows'" -Property 'id', 'deviceId', 'displayName', 'trustType', 'accountEnabled', 'approximateLastSignInDateTime' |
    Where-Object { -not $devicesWithKeys.ContainsKey($_.DeviceId) } |
    Sort-Object ApproximateLastSignInDateTime -Descending |
    Select-Object DisplayName, DeviceId, TrustType, AccountEnabled, ApproximateLastSignInDateTime

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• Matches keys to devices on the device's deviceId property. The bitlockerRecoveryKey resource's deviceId identifies the device the key was backed up from, which is the device's deviceId (set at registration), not the device object's id.
• Reads key metadata only. The list call is made without -Property ($select), and per the cmdlet reference the key property is returned only when it is selected.
• A device appears here if no key was ever backed up to Entra ID, including devices that are not encrypted and devices whose keys are kept only in on-premises Active Directory.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.